REMARKS 

I. Introduction 

With the addition of claim 56, claims 1 to 3, 5 to 12, 14 to 24, 26 to 33, 35 to 
44, 46, and 56 are pending in the present application. In view of the foregoing amendments 
and the following remarks, it is respectfully submitted that all of the presently pending claims 
are allowable, and reconsideration is respectfully requested. 

II. Interview 

Applicants thank Supervisory Examiner Andrew Caldwell for the courtesies 
extended during the course of the personal interview conducted on April 25, 2007 with Peter 
Treloar, Australian counsel for Tier-3 Pty Limited, assignee of the present application, and 
Applicants' representative, Jason Mueller (Reg. No. 58,603). 

During the course of the interview, no exhibits were shown or demonstrations 

conducted. 

During the course of the interview, claim 1 was primarily discussed. 

During the course of the interview, U.S. Patent No. 6,530,024 ("Proctor") was 
discussed. As part of these discussions, the feature of raising an alert if a weighting assigned 
to an event exceeds a predetermined threshold and the feature of applying a heuristic, if the 
weighting is below said predetermined threshold, to determine if said event is statistically 
significant in a historical context of previously generated event to determine said action 
response were discussed. 

During the course of the interview, the principal proposed amendments of a 
substantive nature discussed are reflected in claim 1 as presented herein. 

During the course of the interview, the general thrust of the principal 
arguments of the Applicant included the lack of disclosure in Proctor of the feature of 
applying a heuristic, if the weighting is below said predetermined threshold, to determine if 
said event is statistically significant in a historical context of previously generated event to 
determine said action response. 

The general result of the interview was that no agreement was reached. 

III. Rejection of Claims 1 to 3, 5 to 12, 14 to 24, 26 
to 33, 35 to 44 and 46 Under 35 U.S.C. S102(e) 

Claims 1 to 3, 5 to 12, 14 to 24, 26 to 33, 35 to 44 and 46 have been rejected 

under 35 U.S.C. § 102(e) as being anticipated by U.S. Patent No. 6,530,024 ("Proctor"). It is 
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respectfully submitted that Proctor does not anticipate the present claims for at least the 
following reasons. 

To anticipate a claim under 35 U.S.C. § 102(e), a single prior art reference 
must identically disclose each and every claim feature. See Lindeman Machinenfabrik v. 
American Hoist and Derrick, 730 F.2d 1452, 1458 (Fed. Cir. 1984). If any claim feature is 
absent from a prior art reference, it cannot anticipate the claim. See Rowe v. Dror y 112 F.3d 
473,478 (Fed. Cir. 1997). 

Claim 1 provides a method for monitoring events generated on at least one 
computer system and, as herein amended without prejudice, recites "issuing an appropriate 
action . . . including: (i) raising an alert if a weighting assigned to said event exceeds a 
predetermined threshold; and (ii) applying a heuristic, if said weighting is below said 
predetermined threshold, to determine if said event is statistically significant in a historical 
context of previously generated events to determine said action response." As illustrated in 
Fig. 7, steps S710-S770 and page 13, line 20 to page 14, line 15 of the Application, the 
approach can be used to look at previous events to determine if one or more events have any 
historical significance. This technique can determine, for example, if an event may have 
been a part of a long term attack, for example. 

As noted in the response filed February 21, 2006, Proctor discloses adapting 
security procedures based on computing environment activity, including utilizing defined 
security procedures. The adaptive feedback system of Proctor actively monitors the 
processing environment, detecting security incidents based on the defined security 
procedures. 

In support of the present rejection, the Office Action asserts that the 
"immoderate steps" of Proctor discloses the weighting of claim 1. However, the 
"immoderate steps" of Proctor relate specifically to "security response actions." In the 
passage from col. 7 line 5 through line 14, Proctor discloses the "immoderate steps" as being 
the possible actions of shutting down a target computer, logging off a particular user, 
minimizing access granted to a suspected user, or other action. The immoderate steps of 
Proctor are post-determination activities, which is inconsistent with the claimed "weighting" 
that is applied for raising an alert if the weighting exceeds a predetermined threshold and 
otherwise applying a heuristic to determine whether the event is statistically significant. 

In the Advisory Action, the Examiner asserts that Proctor, at column 9, line 65 
to column 10, line 14, discloses thresholds or limits, which, when reached, trigger an alarm or 
other condition, and therefore inherently discloses a weighting compared to a threshold. To 
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rely on inherency, the Examiner must provide a "basis in fact and/or technical reasoning to 
reasonably support the determination that the allegedly inherent characteristics necessarily 
flows from the teachings of the applied art." {See M.P.E.P. § 21 12 (emphasis in original); 
and see Ex parte Levy, 17 U.S.P.Q.2d 1461, 1464 (Bd. Pat. App. & Int'f. 1990)). Thus, the 
M.P.E.P. and the case law make clear that simply because a certain result or characteristic 
may occur in the prior art does not establish the inherency of that result or characteristic. 
Therefore, for an element to inherently include feature A, feature A must necessarily be part 
of that element. If feature A is necessarily a part, or characteristic, of an element, than there 
can be no instance of the element existing without feature A. The mere assertion of the 
Examiner that a weighting must be assigned to an event for comparison with the threshold 
referred to by Proctor, proffered without any supporting proof, is insufficient to establish this 
necessity. Indeed, Proctor describes an exemplary threshold as a number of log-in attempts 
after which a flag is raised. The number of log-in attempts is not an assigned weighting. The 
Examiner has therefore not met his burden of establishing inherency. 

Furthermore, even assuming for argument's sake that Proctor discloses the 
assigned weighting as provided for in the context of claim 1 (which Applicants do not 
concede), Proctor does not disclose applying a heuristic if the weighting is below the 
threshold to determine if the event is statistically significant in a historical context of 
previously generated events. 

Accordingly, Proctor does not disclose, or even suggest, all of the features 
recited in claim 1 , and therefore does not anticipate claim 1 . 

Claims 22 and 43 include subject matter analogous to that of claim 1. It is 
therefore respectfully submitted that Proctor does not anticipate either of claims 22 and 43 for 
at least the same reasons as claim 1 . 

As to claims 2, 3, 5 to 12, and 14 to 21; 23, 24, 26 to 33, and 35 to 42; and 44 
and 46, these claims depend from claims 1, 22, and 43, respectively, and therefore include all 
of the features recited in their respective base claims. It is therefore respectfully submitted 
that Proctor does not anticipate these dependent claims for at least the same reasons set forth 
above in support of the patentability of their respective base claims. 

Withdrawal of this rejection is therefore respectfully requested. 
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IV. New Claim 56 

New claim 56 has been added herein. It is respectfully submitted that new 
claim 56 adds no new matter and is fully supported by the present application, including the 
Specification, e.g., at page 13, line 20 to page 14, line 15. 

Claim 56 relates to a method for monitoring events generated on at least one 
computer system, and recites, inter alia, "determining an action response based upon: (i) said 
predefined set of rules associated with said event; and (ii) a comparison of said event with 
other monitored events recorded in said database to determine if the event is a historically 
statistically significant event relative to the other events recorded in said database." It is 
respectfully submitted that Proctor does not disclose or suggest these features. It is therefore 
respectfully submitted that claim 56 is patentable over Proctor. 

V, Conclusion 

In light of the foregoing, Applicants respectfully submit that all of the pending 
claims are in condition for allowance. It is therefore respectfully requested that the rejections 
be withdrawn. Prompt reconsideration and allowance of the present application are therefore 
respectfully requested. 

Respectfully submitted, 
KENYON & KENYON LLP 



Dated: July 9, 2007 
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